Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [capabilities]

POSIX Capabilities are a way to split full superuser privileges into smaller partitions of privileges. Use this tag for questions on managing and using capabilities.

0
votes
0answers
27 views

Capabilities to start a systemd service

I'm starting a process with the cap_kill capability and use this process to kill other services. However I'd like to be able to restart these service with a systemctl restart xxx Is there a ...
0
votes
1answer
19 views

setcap binary but with arguments?

I'm trying to start BoringTun with setcap in order for it to run unprivileged but still have the ability to fmark: root@67672793823c:/# setcap cap_net_admin+epi /usr/local/sbin/boringtun --foreground ...
0
votes
1answer
50 views

Docker running an app with NET_ADMIN capability: involved risks

I'm trying to run an app in a docker container.The app requires root privileges to run. sudo docker run --restart always --network host --cap-add NET_ADMIN -d -p 53:53/udp my-image My question is: ...
3
votes
1answer
61 views

Why is CAP_NET_ADMIN insufficient permissions for ioctl(TUNSETIFF)?

I'm trying to write a tun/tap program in Rust. Since I don't want it to run as root I've added CAP_NET_ADMIN to the binary's capabilities: $sudo setcap cap_net_admin=eip target/release/tunnel $getcap ...
0
votes
0answers
39 views

Give root's permission to restricted user using PAM and Linux capabilities

I want to give root's permission (or root account) to my test's user not using wheel-group or sudoers on CentOS 7. Instead I would like to use module pam_cap.so and linux capabilities. I try this: ...
1
vote
1answer
26 views

Difference between file capability and process capability

I am trying to understand POSIX Capabilities. Sometimes, when reading the documentation they refer to file capabilities and sometimes to process capabilities. What is the difference between file and ...
0
votes
1answer
57 views

Can you assign Linux capabilities to users?

In Solaris, I believe that you can assign privileges to users. I know that in Linux you can assign capabilities to executable files, but can you also assign capabilities to users?
4
votes
2answers
198 views

Does macOS and Solaris have “capabilities”?

Linux have capabilities, which are used to give a non-root process some privileges. Does macOS and Solaris also have capabilities? if not, do they have something similar to capabilities?
1
vote
3answers
60 views

Does a process that have the root user always have all of the capabilities available in Linux?

In Linux, a process that have a non-root user can have some capabilities assigned to it to increase its privileges. And a process that have the root user have all of the capabilities available, but ...
0
votes
0answers
21 views

Better use ACL or Capability to let users start a service?

My question is openned to other propositions too. An install sequence puts a binary in the directories (say bin1 in PATH_TO_BIN1). It configures a service in /etc/init.d The service has to be ...
0
votes
1answer
47 views

Difference between running a process as root and running process with all the linux capabilities

I have a docker container which runs perfectly fine in a kubernetes pod when privileged:true is set in the specification. But when I run the same docker container, by giving all the linux capabilities,...
3
votes
1answer
105 views

Ping not working in a new C container

I've been working on writing my own Linux container from scratch in C. I've borrowed code from several places and put up a basic version with namespaces & cgroups. Basically, I clone a new ...
3
votes
0answers
178 views

How to escape from a hardened chroot on Linux when only file capabilities are available to the attacker?

There is a chroot environment in /var/myroot, and an attacker has obtained arbitrary machine code execution in a process running as root (EUID 0) in the chroot. But the processes under control of the ...
5
votes
1answer
362 views

Is setcap deprecated?

I'm starting a webserver as non-root using a systemd unit file. I am getting listen tcp :80: bind: permission denied even though I already ran setcap cap_net_bind_service=+ep on the executable. ...
0
votes
0answers
25 views

What is the “Securebits:” in capsh --print

I ran capsh --print inside a container and saw this: Securebits: 00/0x0/1'b0 secure-noroot: no (unlocked) secure-no-suid-fixup: no (unlocked) secure-keep-caps: no (unlocked) What is Securebit ...
1
vote
0answers
36 views

Does every syscall require at most 1 capability on Linux?

I am trying to understand the relationship between capabilities and syscalls on Linux. As far as I know, the capabilities of a process are only ever considered when that process calls a syscall. When ...
1
vote
1answer
114 views

Why do I get permission denied when using unshare?

I'm exploring the namespace feature of linux kernel, using Archlinux. But I got some message that I can't explain the reason, could anyone explain them to me? xtricman⚓ArchVirtual⏺️~🤐export LANG=...
0
votes
1answer
262 views

Error with setcap CAP_SYS_TIME+ep /user/mybinaryprogram

I'm trying to use the capabilities (CAP_SYS_TIME) but when I run this command: setcap CAP_SYS_TIME+ep /user/mybinaryprogram on my system, I get the following error: Failed to set capabilities ...
1
vote
1answer
75 views

What properties of an unprivileged process are preserved during an `execve` call?

I am teaching an Operating Systems course and trying to wrap my mind around the fork/execve technique for creating new processes. My current understanding is that a fork make a complete copy of the ...
1
vote
2answers
143 views

How shall we understand the rules of capabilities with respect to exec()?

From The Linux Programming Interface: The permitted set is a limiting superset for the capabilities that can be added to the effective and inheritable sets. Does it mean that the permitted set ...
2
votes
1answer
286 views

How does Magisk on Android work as su without setuid and capabilities?

I've read in another answer that on Android the su binaries avoid needing to be setuid by using filesystem capabilities like cap_setuid. But then I tried to check this, and to my surprise, I found no ...
1
vote
1answer
735 views

Trying to disable some Bluetooth features on RPi3

I'm trying to make my RPi3 to be a bluetooth sink. My problem is that when I'm trying to connect my Windows 7 Laptop to my RPi Bluetooth sink, it is displayed like that : Sorry, it's in french. It ...
1
vote
1answer
103 views

Access /proc/pid/ns/net without running query process as root?

In a program I'm enumerating network namespaces by scanning /proc/pid/ for ns/net links. This program runs inside the "root" namespaces (original init) of the host itself. Normally, I need to run the ...
4
votes
1answer
530 views

Linux Capabilities with User Namespaces

I'm confused about how file capabilities work with regards to user namespaces. As I understand it, if a file has a capability, then any threads/process executing the file can attain the capability. ...
0
votes
0answers
18 views

Granting service specific capabilities

I have a sm-t365 rooted tablet. I've created a service in the init.rc file that all it does is create a folder in /data (which requires root), it works if in my service in init.rc i specify user root.....
5
votes
1answer
15k views

How to set capabilities with setcap command?

I would like to set up wpa_supplicant and openvpn to run as non-root user, like the recommended setup for wireshark. I can't find any documentation for what +eip in this example means: sudo setcap ...
9
votes
2answers
2k views

When using setcap, where is the permission stored?

Using setcap to give additional permissions to a binary should write the new permission somewhere, on storage or in memory, where is it stored ? Using lsof as is doesn't work because the process ...
5
votes
2answers
4k views

Can you list iptables as a non-root user and why?

Is it at all possible to execute iptables --list …. command without being root? Running it as non-root prints this: $ iptables --list iptables v1.4.21: can't initialize iptables table `filter': ...
0
votes
1answer
317 views

Systemd and AmbientCapabilities: debugging “Invalid argument” error

I am running Arch Linux. My problem originally manifested with Caddy web server, but it is not limited to it. Thus I have a simple unit to troubleshoot with a random binary (capsh): [Service] ...
4
votes
1answer
3k views

How to read the /proc/<pid>/fd directory of a process, which has a linux capability?

As a non-root user I am running a process. The process binary has been given a cap_sys_resource capability. Even though the process is owned by the same user, that user cannot read its /proc//fd ...
3
votes
0answers
148 views

setcap on dhclient appears to have no effect

I'm having a rather frustrating time getting dhclient to run from a normal user using setcap. Because of the environment I am working with, adding to sudoers is not an option. My attempt: sudo ...
6
votes
1answer
496 views

How do I run a process that wants to become root from a systemd service which is a regular user?

I have a service that I start using systemd. The service user and group are changed to a non-privileged user. [Service] ... User=regular_user Group=regular_user ... At some point the service needs ...
1
vote
1answer
758 views

Find out what capabilities a process needs

I want to allow run zfs zpool commands without root and sudo. I suppose that I need to give some capabilities to user, but how to get list of capabilities needed by some particular command? The OS is ...
10
votes
2answers
10k views

Unset `setcap` additional capabilities on excutable

An answer to Linux: allowing an user to listen to a port below 1024 specified giving an executable additional permissions using setcap such that the program could bind to ports <1024: setcap '...
4
votes
1answer
385 views

why is CAP_SYS_ADMIN needed for CLONE_NEWPID?

man 2 unshare tells us Use of CLONE_NEWPID requires the CAP_SYS_ADMIN capability and the suggested reading for further information man 7 pid_namespaces does not really discuss the presumable risk ...
4
votes
2answers
709 views

Why are not all permitted capabilities of a linux process effective all the time?

man 7 capabilities documents that the capabilities of a process on a linux box are recored a set of three masks: permitted effective inheritable I have an idea to what extend the inheritable mask ...
5
votes
1answer
433 views

How to identify what capabilities are required for a command?

When I run a command within a docker container, I see: # ip netns exec 9ee961d90990 ifconfig setting the network namespace "9ee961d90990" failed: Operation not permitted I can launch my container ...
4
votes
1answer
242 views

Linux File Capabilities are lost when I modify the file. Is this expected behavior?

When I modify a file, the file capabilities I had set earlier are lost. Is this the expected behavior? I first set a file capability: $ setcap CAP_NET_RAW+ep ./test.txt $ getcap ./test.txt ./test....
1
vote
1answer
1k views

how do I give users capabilities

How do I give users capabilities in OSX? I googled it and I found no answers. The setcap command doesn't exist in OSX.
5
votes
1answer
757 views

Can I add iptables rule from the inside of a C Linux program only with capabilities or do I need necessarily root?

I need to add an iptables rule from the inside of a C Linux program. How should I do? Do I need root privilege or can I just grant some capabilities? I tried granting CAP_NET_RAW+iep and using popen(...
3
votes
1answer
147 views

Why can't a UID 0 process hardlink to SUID files in a user namespace?

Consider the following transcript of a user-namespaced shell running with root privileges (UID 0 within the namespace, unprivileged outside): # cat /proc/$$/status | grep CapEff CapEff: ...
0
votes
0answers
261 views

Linux capabilities for java to resolve symbolic links

I run a java program by a non-root user. The program has to resolve a symlink to the real file name, but the link is owned by a different non-root user. I used setcap to set capabilities to open root-...
3
votes
1answer
133 views

Replacement for cap-bound

We have an old Linux from scratch kernel used in one of our systems, that uses the old cap-bound mechanism (modifying /proc/sys/kernel/cap-bound) to restrict the capabilities of the system. This was ...
5
votes
1answer
272 views

Sandboxing a binary on linux

I am trying to understand various options I have to restrict/sandbox a binary in Linux. I see that I can use namespaces and cgroups like docker does. I could use SELinux like this link suggests. Which ...
5
votes
3answers
4k views

Which Linux capability do I need in order to write to /proc/sys/vm/drop_caches?

I am trying to clear my filesystem cache from inside a docker container, like so: docker run --rm ubuntu:vivid sh -c "/bin/echo 3 > /proc/sys/vm/drop_caches" If I run this command I get sh: 1: ...
2
votes
1answer
3k views

How to see if a file has CAP_NET_ADMIN?

I ran the following command: sudo setcap cap_net_raw,cap_net_admin,cap_net_bind_service+eip `which nmap` Now I'd like to add to my ~/.zshrc a line that detects such settings and exports ...
10
votes
3answers
6k views

How do I use capsh: I am trying to run an unprivileged ping, with minimal capabilities

I am experimenting with capabilities, on Debian Gnu/Linux. I have copied /bin/ping to my current working directory. As expected it does not work, it was originally setuid root. I then give my ping ...
2
votes
1answer
9k views

How to install Linux capabilities like setcap and getcap?

In my openSUSE 13.2 machine I can apply commands like setcap and getcap on some application. I moved that application to an openSUSE 12 machine that does not have capabilities installed. In the 13.2 ...
1
vote
1answer
770 views

How to run smartctl as root without switching to root?

I have this C code that runs smartctl command and takes its output: #include <iostream> #include <cstdio> #include <cstdlib> using namespace std; int main() { cout << "...
1
vote
1answer
1k views

Set hostname without root, and without CAP_SYS_ADMIN

I have an application that I want to be able to change the hostname in Linux. Currently doing so by running the hostname command. I don't want to set CAP_SYS_ADMIN either. I also don't want to edit ...